Secure Data Rooms

HGSE researchers are frequently the recipients of highly sensitive or confidential information from their data providers. As such, these researchers are sometimes required to reserve a secure data room in which to perform and analyze their research due to 1.) Certain data classification levels assigned by their respective Institutional Review Board (IRB) (either Longwood Medical Area or University Area), 2.) Terms of Restricted-Use data licenses, or 3.) Terms of Data Use Agreements (DUAs) negotiated between HGSE’s Office of Sponsored Projects (HGSE-OSP) and data providers.

NCES/IES Secure Data Room (SDR)

NCES/IES Restricted-Use data Licenses impose significant restrictions on who can have a License, who can access the data, and where and how the data can be housed. One such restriction includes the use of secure data room where the Restricted-Use data is stored and used by Licensed researchers.

Due to the widespread demand for NCES/IES Restricted-Use data from our student and faculty researchers at HGSE combined with the significant resource overhead required of license applicants (e.g., NCES/IES Restricted-Use data can only be stored and used on an pre-approved stand-alone, non-networked desktop computer stored within a pre-approved, access controlled space), HGSE has allocated and exclusively dedicated Room 307 in Gutman Library for use as a shared, NCES/IES Restricted-Use Secure Data Room (SDR). Gutman 307 has been pre-approved by NCES/IES as a centralized location at HGSE where approved NCES/IES Restricted-Use data users may store and work with their data.

NOTE: While those researchers looking to apply for an NCES/IES Restricted-Use data license (as users or as a PPO) are not required to use the SDR as their designated secure data room, an alternative space would need to be suggested by the researcher and reviewed/approved (timeframe averages anywhere between 1-4 months) as feasible and secure by HGSE's Director of Security Operations (DSO) and HGSE's Operations Department. While some HGSE faculty members may have a preferred office space available they'd like converted into a secure data room exclusively for their/their students' use, often, no availability exists, and as such, all are encouraged to utilize the SDR for their NCES/IES Restricted-Use data needs.

SDR Resources

Room Availability 

The SDR is available for use by Licensed users (see how to gain access in the following section) between the hours of 9 a.m. - 5 p.m., however library hours change seasonally (regular, intersession, summer, and reference hours). For the most up-to-date regular and seasonal hours, please visit: https://www.gse.harvard.edu/library/hours

Hardware, Software, & File Storage 

  • Hardware: Seven (7), non-networked Dell OptiPlex 7050 MT desktop computers equipped with the following: 
    • Microsoft Windows 10 operating system 
    • Processor: Intel® Core™ i7-7700 
    • Memory: 32 GB (4x8GB) 2400MHz DDR4 
  • Software: 
    • 7-zip 
    • Adobe Acrobat Pro 2017 
    • FileZilla 
    • MPlus 
    • Microsoft Office Pro Plus 2016 
    • R for Windows 
    • RStudio 
    • Rtools 
    • SAS University Edition 
    • SPSS Statistics 
    • Stata 
    • Stat Transfer
  • File Storage
    • While users are permitted to store their statistical analysis files locally on the SDR's desktop computers, given the inherrent risks accompanying any user computer or device for failure due to any number of reasons, users are strongly encouraged to manually backup their permitted files using an encrypted thumb drive or external hard drive as the recovery of lost user files due to a system's failure will be unlikely (for device recommendations, please see HGSE's Recommend Encryption Tools). Due to NCES/IES regulations, no backups of the Restricted-Use data are permitted and the local hard drives of the computers in the SDR are not backed up by HGSE IT.

Apply for a New NCES/IES Restricted-Use License in the SDR

Please note, you must have a direct affiliation with HGSE as a faculty, student, or staff member to apply for a NCES/IES Restricted-Use License at HGSE. Similarly, applicants must read the NCES/IES Restricted-Use Data Procedures Manual. This manual outlines in full all required procedures and restrictions on Restricted-Use data and Licenses.

  1. Obtain IRB Approval: Researchers must have an approved Committee on the Use of Human Subjects (CUHS) (Longwood Medical Area)/Institutional Review Board (IRB) (University Area) protocol, be added to an existing one, or submit a new protocol for the project you plan use the NCES/IES Restricted-Use data for via Harvard's Electronic Submission Tracking and Reporting (ESTR) platform.
  2. Application Personnel: Applicants must designate the following three individuals on their application to qualify for and receive a Restricted-Use data License from NCES/IES, as these persons will sign the required and applicable documents in Step #3 for the License:
    1. Principle Project Officer (PPO): A PPO is responsible for the day-to-day operations involving the requested data. Academic applicants must have the rank of post-doctoral fellow or above to serve as the PPO (applicants unable to meet this standard must secure an HGSE faculty member willing to serve as PPO). Visiting professors or scholars cannot be a PPO, and applicants in research laboratories or analytic consulting firms must have the rank of research associate or above to serve as a PPO.
    2. Senior Official (SO): Each application must have the support of a SO who has the legal authority to sign the License (contract) on behalf of the institution to bind them to the terms of the License. At HGSE, applicants are asked to submit their proposed research to University-OSP within the Agreements-DUA Application, as an appropriate SO will will be assigned by University-OSP via that Application.
    3. Systems Security Officer (SSO): Each application must have a SSO to oversee the security of the data. At HGSE, applicants will list HGSE's Director of Security Operations (DSO) as the SSO on their Restricted-Use data License application: Sarah Pruski, Director of Security Operations; Harvard Graduate School of Education, Information Technology, 6 Appian Way, Room 345, Cambridge, MA 02138; Phone: 617-384-7859; Email: sarah_pruski@gse.harvard.edu
  3. Formal Request & Application: Step #3 includes both an online component, as well as a physical paper application component. The former includes the requirement for the PPO to submit a Formal Request for the Restricted-Use License to IES. An applicant may designate up to seven users who will access the Restricted-Use data on their License, though the PPO, SSO (Sarah Pruski), and a support staff member of the ITSC/Infrastructure Technologies group (Beau Fujita) must be counted as three of these seven persons. Once IES receives the Formal Request online, the PPO must then submit the following three physical documents:
    1. A signed IES License Document (View IES Instructions)
    2. Executed Affidavit(s) of Nondisclosure for all intended users on the License (again and at a minimum, an affadavit is required from the PPO, SSO (Sarah Pruski), and a support staff member of the ITSC/Infrastructure Technologies group (Beau Fujita). Please email the SSO and support staff member directly to request and collect their executed affadavits) (View IES Instructions) - Each affidavit must contain the following statement within the upper-right box labeled "NCES Database or File Containing Individually Identifiable Information": All NCES/IES Data. This statement clears each user on the License to view current or future NCES/IES Restricted-Use datasets on their PPO's License within the approved secure data room and forgo the execution of new affidavits for each user. Do not sign on the signature line until in the presence of a notary. Doing so in advance will nullify the affidavit, and you will be required to re-complete a new document before signing in front of the notary. Harvard University provides notary services to Harvard community members at select offices. Public notary services are also available through commercial businesses in the area. Please note the hours, required evidence of identity, and any applicable fees for notarization at each respective location: 
      • Harvard Office of the General Counsel 
      • Harvard University Employee Credit Union
      • The UPS Store 
      • Bank Notaries: Most banks have a notary public on hand at all times. If you use a certain bank regularly, contact your bank or stop by to inquire about notary services, when they are available and how much they cost. Some banks will notarize documents free of charge if you have a bank account at that specific institution. 
      • Courthouse Notaries: You can always get something notarized at the courthouse during business hours. Many courthouse clerks do double duty as notaries, but you can call ahead to find out which office to head to in order to get your document notarized, as well as what type of costs you should expect for the service. Generally, the county clerk’s office should be able to assist you with notary needs.
    3. A signed Security Plan Form (View IES Instructions) - For applicants utilizing the SDR, applicants may obtain a pre-filled Security Plan Form from HGSE's SSO/DSO, Sarah Pruski. Applicants wishing to use a space other than the pre-approved secure data room in Gutman Library must first consult with HGSE's DSO by contacting the IT Service Center in order to confirm the space meets the minimum NCES/IES requirements and the applicant has procured a dedicated, stand-alone and non-networked desktop computer for Restricted-Use data.
    4. Certificates of completion from all intended users on the License (including HGSE's SSO/DSO (Sarah Pruski), and a support staff member of the ITSC/Infrastructure Technologies group (Beau Fujita​​​​​​​) for the NCES/IES Restricted-Use Data License Training. (Please note that this will be an annual requirement of your intended users in order to be in compliance with NCES/IES policies.)
  4. Duplicate & Submit: To complete the application, securely mail (tracking and/or certification strongly recommended) the signed IES License Document, the notarized affidavit(s) of nondisclosure for all users, the signed Security Plan Form, and training certificates to: IES Data Security Office; Department of Education/IES/NCES, 550 12th Street, SW, Room 4060, Washington, DC 20202; Phone: 202-245-7674. Prior to mailing your application, please make a photo/digital copy of the completed application package.
  5. If the application is approved, the PPO will receive the following information. Once approved, the applicant must notify HGSE's DSO who will send a request to Operations (maintenance@gse.harvard.edu) for the approved users' physical access to the SDR. Similarly, once approved, applicants must contact Beau Fujita​​​​​​​ via the IT Service Center in order to receive login credentials to the stand-alone desktop computers in the SDR.

 

Non-NCES/IES Secure Data Room Request Process

HGSE has developed a secure data room request workflow and process to assist its researchers in determining whether or not they 1.) Require a secure data room for their research, and if so, 2.) How and where to begin the application process. Researchers are encouraged to request a security consultation with HGSE's Director of Security Operations (DSO) by contacting the the IT Service Center to help determine their specific needs for a secure data room.